MD5: bf7a7452f40e0d21716814857a0a77f9
SHA1: f55526a8f590e5fa25a25225d1b26af202c0739a
SHA256: 9c798c14b0281a513118d2852f37ead5df4345463fe9ca31c2de0709bd9caea8
SSDeep: 24576:M7kSLsPpRbwFnyOrd41zcDbuLvpVnwXxh:G1sR6FnyOrd4S6pVy
Size: 1036416 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: TODO:
Created at: 2014-10-24 23:27:09
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

10772426_:3308
%original file name%.exe:644

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process 10772426_:3308 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\errorpagestrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\HttpErrorPagesScripts[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\syntax[1] (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\104[1] (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)

The process %original file name%.exe:644 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\10772426_ (62084 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\10772426 (874 bytes)

Registry activity

The process 10772426_:3308 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"fdwSupport" = "1"
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\10772426__RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\10772426__RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Microsoft\Tracing\10772426__RASMANCS]
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\10772426__RASAPI32]
"MaxFileSize" = "1048576"
"FileDirectory" = "%windir%\tracing"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\10772426__RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\10772426__RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"

"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\10772426__RASMANCS]
"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: TODO:
Product Name: TODO:
Product Version: 1.0.0.1
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: Installer.exe
Internal Name: Installer.exe
File Version: 1.0.0.1
File Description: Firefox_Updater
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 2
94359ae4d52507bcfc79d494235641bd
a1b086d8bcc1d11321740ab4b108004c

URLs

URL	IP
hxxp://installmetrix.com/common/gate/installer_gate_client.php?download_id=10772426&mode=prechecking	209.188.85.69
hxxp://installmetrix.com/common/gate/installer_gate_client.php?download_id=10772426&mode=getcombo&offers=	209.188.85.69

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /common/gate/installer_gate_client.php?download_id=10772426&mode=getcombo&offers= HTTP/1.1

User-Agent: 10772426_

Host: installmetrix.com

HTTP/1.1 404 Not Found

Date: Fri, 09 Dec 2016 09:28:12 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 354

Connection: close

Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /co
mmon/gate/installer_gate_client.php was not found on this server.</
p>.<p>Additionally, a 404 Not Found.error was encountered whi
le trying to use an ErrorDocument to handle the request.</p>.<
;/body></html>...

GET /common/gate/installer_gate_client.php?download_id=10772426&mode=prechecking HTTP/1.1

User-Agent: 10772426_

Host: installmetrix.com

HTTP/1.1 404 Not Found

Date: Fri, 09 Dec 2016 09:28:12 GMT

Server: Apache

Vary: Accept-Encoding

Content-Length: 354

Connection: close

Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /co
mmon/gate/installer_gate_client.php was not found on this server.</
p>.<p>Additionally, a 404 Not Found.error was encountered whi
le trying to use an ErrorDocument to handle the request.</p>.<
;/body></html>...

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

@.reloc

u(SSSSSh

PSSSSSSh

f;T$.uBf

QSShx'

tFHt:Ht.Ht"Hu`

j%XtL9E

t'SShl

SSSSh

tWSShW

tl9_ tgSSh

u$SShe

FTCP

u.Ph<

tAHt.HHt

FtPW

SSh@B

<SShG

s%j.Zf

RegOpenKeyTransactedW

RegCreateKeyTransactedW

CCmdTarget

RegDeleteKeyTransactedW

CNotSupportedException

CHttpFile

RegDeleteKeyExW

TaskDialogIndirect

CMDITabProxyWnd

CMDIChildWndEx

CMDIFrameWndEx

CMDIChildWnd

CMDIFrameWnd

CMDIClientAreaWnd

CMFCToolBarsKeyboardPropertyPage

GetProcessWindowStation

operator

hXXp://installmetrix.com/common/gate/report.php?download_id=%s&mode=%d&combo_id=%d&os_name=%s&os_add=%s&os_build=%s&proj_id=%s&offer_id=%s&templateid=%s

</offer_url>

<offer_url>

</software_url>

<software_url>

</software_exiturl>

<software_exiturl>

first url

Windows 8

Windows Server 2012

Windows 7

Windows Server 2008 R2

Windows Vista

Windows Server 2008

Windows XP Professional x64 Edition

Windows Server 2003

Windows XP

Windows 2000

WebStroller=I

GetWindowsDirectoryW

GetCPInfo

KERNEL32.dll

CreateDialogIndirectParamW

GetKeyState

SetWindowsHookExW

UnhookWindowsHookEx

GetKeyNameTextW

MapVirtualKeyW

GetAsyncKeyState

GetKeyboardLayout

GetKeyboardState

MapVirtualKeyExW

USER32.dll

GetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportOrgEx

GDI32.dll

MSIMG32.dll

COMDLG32.dll

WINSPOOL.DRV

RegOpenKeyExW

RegCloseKey

RegCreateKeyExW

RegDeleteKeyW

RegEnumKeyW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

COMCTL32.dll

UrlUnescapeW

SHLWAPI.dll

ole32.dll

OLEAUT32.dll

oledlg.dll

GdiplusShutdown

gdiplus.dll

OLEACC.dll

InternetCrackUrlW

InternetCanonicalizeUrlW

HttpQueryInfoW

InternetOpenUrlW

WININET.dll

IMM32.dll

WINMM.dll

.?AVCCmdUI@@

.PAVCMemoryException@@

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.?AVCHttpFile@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WV12@PB_W@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCDocument@@PAV3@@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W_N_N@@

.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.?AVCMFCToolBarCmdUI@@

.?AVCMDITabProxyWnd@@

.?AVCMDIChildWndEx@@

.?AVCMDIChildWnd@@

.?AVCMDIFrameWndEx@@

.?AVCMDIFrameWnd@@

.PAVCOleDispatchException@@

.?AVCMFCCmdUsageCount@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WPAVCObList@@PAV3@@@

.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@

.?AVCMDIClientAreaWnd@@

.?AVCMFCRibbonCmdUI@@

.?AVCMFCColorBarCmdUI@@

.?AV?$CMap@KKV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_W@@

.?AVCMFCAcceleratorKey@@

.?AVCMFCToolBarsKeyboardPropertyPage@@

.?AV?$CMap@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PB_WHH@@

.?AVCMFCRibbonKeyTip@@

.?AVCMFCTasksPaneToolBarCmdUI@@

.?AVCMFCAcceleratorKeyAssignCtrl@@

zcÁ

.?AVCCmdTarget@@

.PAVCException@@

.?AVCWebGrab@@

.?AVCWebGrabSession@@

.PAVCInternetException@@

.PAVCFileException@@

.?AVCWebPage@@

10772426

C:\Users

CCC.jjj

SSShzzz

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="hXXp://VVV.w3.org/1999/xhtml">

var x = document.cookie;

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

<!--The ID below indicates application support for Windows Vista -->

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />

1 2$2(2,2

4L4]4w4

040:0`0}0

>&>,>"?9?

01

11?1^1

!171!2-2~2

=.=;=$>4>

8„8S8b8p8

88v8

5,626;6~6

515<5d6

4 4$4(4,4

> >$>(>,>0>4>8>

6 6$6(6,6064686<6@6\6`6|6

2 2$2(2,20242\2`2|2

= =$=(=,=0=4=8=<=@=

: :$:(:,:0:4:8:<:@:

=,=8=\=|=

7 7$7(7,7074787

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

KERNEL32.DLL

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

lX-X-x-XX-XXXXXX

Advapi32.dll

res://%s/%s

res://%s/%d

comctl32.dll

comdlg32.dll

shell32.dll

accKeyboardShortcut

wuser32.dll

hhctrl.ocx

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp

hXXp://

WININET.DLL

SHELL32.DLL

lXXxXXXXXXXX

dwmapi.dll

UxTheme.dll

eShell32.dll

%s:%x:%x:%x:%x

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

kernel32.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

mfcm100u.dll

%sMFCToolBar-%d%x

%sMFCToolBar-%d

%sMFCToolBarParameters

TOOLBAR_RESETKEYBAORD

&%d %s

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp

COMCTL32.DLL

USER32.DLL

KeyboardManager

MSG_CHECKEMPTYMINIFRAME

%sDockingManager-%d

MFCLink_UrlPrefix

MFCLink_Url

%sPane-%d%x

%sPane-%d

%sBasePane-%d%x

%sBasePane-%d

windows

ShowCmd

%c%d%c%s

%sMDIClientArea-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp

Hex={X,X,X}

%sMFCOutlookBar-%d%x

%sMFCOutlookBar-%d

%sDockablePaneAdapter-%d%x

%sDockablePaneAdapter-%d

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp

ENABLE_KEYS

KEYS_MENU

KEYS

RICHED20.DLL

RGB(%d, %d, %d)

%sMFCTasksPane-%d%x

%sMFCTasksPane-%d

mscoree.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

Software\Microsoft\NET Framework Setup\NDP\v2.0.50727

Software\Microsoft\NET Framework Setup\NDP\v1.1.4322

Software\Microsoft\.NETFramework\Policy\v1.0

%s %s

hXXp://%s

Downloading %s...

Installing %s...

hXXp://installmetrix.com/common/gate/installer_gate_client.php?download_id=%s&mode=prechecking

hXXp://installmetrix.com/common/gate/installer_gate_client.php?download_id=%s&mode=getcombo&offers=%s

%s is being installed

D:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\atlmfc\include\afxwin1.inl

%s (%s:%d)

.html

chrome

firefox

opera

%USERPROFILE%

amitest.txt

/s /t /i ElectroLyrics /u hXXp://VVV.amoninst.com/index.php

I/s /t /i WebStroller

hXXp://sp-storage.conduit-services.com/spidentifier/1.0.2.0/spidentifierimpl.exe

hXXps://sp-storage.spccinta.com/spidentifier/spidentifierstub/SPIdentifier.exe

hXXp://val.costmin.info

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Test|Result|1;

hXXp://VVV.wajam.com/download/wajam_validate.exe

Webstroller - Amonetize

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

%s = %s

Read %d bytes (%0.1f Kb/s)

Read %d bytes

Resolving name for %s

Resolved name for %s

Unknown status: %d

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\10772426_

1.0.0.1

InstallerManager.exe

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

Note that if you choose to recover the auto-saved documents, you must explicitly save them to overwrite the original documents. If you choose to not recover the auto-saved versions, they will be deleted.fRecover the auto-saved documents

%s [Recovered]

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   10772426_:3308
   %original file name%.exe:644

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\errorpagestrings[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\HttpErrorPagesScripts[1] (5 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\background_gradient[1] (453 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\bullet[1] (447 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\syntax[1] (3 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\104[1] (392 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\ErrorPageTemplate[1] (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\info_48[1] (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\10772426_ (62084 bytes)
   

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.